PaperCut CVE-2026-81578 Auth Bypass via Admin Endpoints

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects unauthenticated network requests targeting specific administration endpoints (SetupCompleted, configure-update-service, or /admin/) of PaperCut NG/MF applications. The rule identifies potential exploitation attempts by flagging successful requests that return HTTP status codes other than 401 (Unauthorized) or 403 (Forbidden), indicating a possible authentication bypass.